You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@solr.apache.org by "janhoy (via GitHub)" <gi...@apache.org> on 2026/10/21 11:49:06 UTC
[PR] fix: authenticated probes must fail when the Solr request fails [solr-operator]
janhoy opened a new pull request, #854:
URL: https://github.com/apache/solr-operator/pull/854
When solrSecurity.probesRequireAuth is set, the generated probe command piped the output of 'solr api' through 'grep -v JAVA_TOOL_OPTIONS' to keep the JVM's "Picked up JAVA_TOOL_OPTIONS: ..." line, which contains the basic auth credentials, out of the probe output that Kubernetes surfaces in pod events.
A pipeline exits with the status of its last command, so the exit code of 'solr api' was discarded and grep's 0 was reported instead. The probes therefore always succeeded, and a pod whose credentials Solr rejects with a 401 was still reported as healthy and ready.
Capture the output in a variable instead of piping, save the exit status, then filter and exit with the saved status. POSIX sh only, so this does not rely on 'pipefail', which dash does not support.
Fixes #799
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] fix: authenticated probes must fail when the Solr request fails [solr-operator]
Posted by "danielmeint (via GitHub)" <gi...@apache.org>.
danielmeint commented on code in PR #854:
URL: https://github.com/apache/solr-operator/pull/854#discussion_r4341567795
##########
controllers/util/solr_security_util.go:
##########
@@ -508,19 +508,22 @@ func useSecureProbe(solrCloud *solr.SolrCloud, probe *corev1.Probe, mountPath st
}
// construct the probe command to invoke the SolrCLI "api" action
+ solrApiCommand := fmt.Sprintf("solr api -get \"%s://${SOLR_HOST}:%d%s\"", solrCloud.UrlScheme(false), probe.HTTPGet.Port.IntVal, probe.HTTPGet.Path)
// Future work - SOLR_TOOL_OPTIONS is only in 9.4.0, use JAVA_TOOL_OPTIONS until that is the minimum supported version
- var javaToolOptionsStr string
- var javaToolOptionsOutputFilter string
+ var probeCommand string
if len(javaToolOptions) > 0 {
- javaToolOptionsStr = fmt.Sprintf("JAVA_TOOL_OPTIONS=%q ", strings.Join(javaToolOptions, " "))
- javaToolOptionsOutputFilter = " 2>&1 | grep -v JAVA_TOOL_OPTIONS"
+ // The JVM echoes "Picked up JAVA_TOOL_OPTIONS: ..." on startup, which would leak the basic auth
+ // credentials into the probe output that Kubernetes surfaces in pod events, so that line has to be
+ // filtered out. The filter must not swallow the exit code of 'solr api' though, otherwise a failing
+ // probe (e.g. a 401) looks like a successful one. Capture the output first, then filter it, then
+ // exit with the status saved before the filter ran. Written for POSIX 'sh', so no 'pipefail'.
+ probeCommand = fmt.Sprintf(
+ "probe_output=$(JAVA_TOOL_OPTIONS=%q %s 2>&1); probe_status=$?; echo \"$probe_output\" | grep -v JAVA_TOOL_OPTIONS; exit $probe_status",
+ strings.Join(javaToolOptions, " "), solrApiCommand)
Review Comment:
Found this as well and it seems more straightforward to solve this via `bin/solr` env vars:
```
SOLR_AUTH_TYPE=basic SOLR_AUTHENTICATION_OPTS="-Dbasicauth=$(cat <dir>/username):$(cat <dir>/password)" solr api -get "<url>"
```
Passing `-Dbasicauth` via `JAVA_TOOL_OPTIONS` also seems to break on Solr 10; and it avoids the "Picked up JAVA_TOOL_OPTIONS" banner
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org